Download the privacy notice PDF
Hesham Fakhri MD PLLC
DBA Vein, Heart and Vascular Institute
Including Venous Leak Center services provided by this practice
Effective date October 18, 2026
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
Who this notice covers
This notice applies to health information maintained by our practice and to our clinicians, employees, trainees, and others working on our behalf. It covers office care, our office based procedures, and our telehealth services. Hospitals, independent laboratories, and other separate providers may have their own notices.
Your privacy contact
Ana Fakhri, Privacy Officer
privacy@veinheartandvascular.com | 813-708-8346
508 S. Habana Avenue, Suite 160, Tampa, FL 33609
Contact our Privacy Officer to exercise any right described here, request the appropriate form, or raise a concern. We may verify your identity or representative authority before releasing information. Please avoid sending detailed medical records or sensitive information by ordinary email; ask us for a secure way to provide them.
Our responsibilities
We must protect the privacy of your protected health information, provide this notice, follow the notice currently in effect, and notify affected individuals after a breach of unsecured protected health information as required by law. We use safeguards and limit access according to job duties. We will not retaliate against you for exercising your rights or filing a complaint.
Care payment and practice operations
Treatment. We use information to evaluate and care for you and may share it with providers involved in your treatment. For example, your cardiologist may send relevant test results to the physician performing your procedure.
Payment. We may use and disclose information to obtain payment, subject to applicable law. For example, we may send a health plan the diagnosis and procedure information needed to process your claim.
Health care operations. We may use information to run the practice, evaluate quality, train staff, arrange services, and meet legal obligations. For example, we may review records to improve procedure safety. Vendors supporting these activities must meet applicable confidentiality and business associate requirements. These examples do not override stricter state or federal protections.
Your rights and choices
See or obtain your records
You may request access to or a paper or electronic copy of information in our designated record sets, including medical and billing records. Ask our Privacy Officer how to submit a request. We generally act within 30 days. If a legally permitted extension is needed, we will explain the reason and expected completion date in writing. Any fee must comply with applicable law. We will explain a denial and available review or complaint rights. We do not withhold access because you owe for treatment.
Request a correction
You may ask us in writing to amend information you believe is inaccurate or incomplete and explain why. We generally act within 60 days, with a written notice if a lawful extension is necessary. We may deny a request where the law permits, such as when the record is accurate and complete. If denied, we will explain why and how to submit a statement of disagreement.
Request private communications
You may ask us to contact you at a different address or by a particular method. Tell us what arrangement you need; we will accommodate reasonable requests. You do not have to explain the reason for the request.
Ask for limits on use or disclosure
You may ask us to restrict information used or disclosed for treatment, payment, or operations, or shared with people involved in your care. We generally do not have to agree, but will follow an agreed restriction subject to legal exceptions. If you pay in full out of pocket for an item or service, we must honor a request not to disclose information solely about that item or service to your health plan for payment or operations, unless disclosure is required by law. Ask before a claim is submitted.
Obtain an accounting of disclosures
You may request a list of disclosures subject to HIPAA accounting requirements for a period of up to six years before your request. The accounting generally excludes treatment, payment, operations, disclosures authorized by you, and other legally excluded categories. We generally respond within 60 days, with notice of a lawful extension when needed. One accounting in a 12 month period is free. We will tell you the fee before processing an additional request so you can withdraw or narrow it.
Choose someone to act for you
A legally authorized personal representative may exercise your rights, subject to applicable law and its exceptions. We verify authority. Parents or guardians may not have access to all records when a minor has independent confidentiality rights.
Get a copy of this notice
You may request a paper copy at any time, including if you previously chose electronic delivery. Contact our Privacy Officer or ask at the front desk.
Family friends and others involved in care
Tell us whom we may contact and what may be shared. When permitted by law, we may share relevant information with someone involved in your care or payment if you agree, have an opportunity to object, or the circumstances reasonably indicate agreement. If you cannot decide, we may use professional judgment in your best interests. Stricter protections still apply.
Other uses and disclosures
Disclosures allowed or required by law
We may use or disclose information for the purposes below only when all applicable legal conditions are met. A request alone does not automatically permit release. We obtain authorization, notice, a court order, or other safeguards when required.
Public health and safety. This may include required disease reporting, product recalls or adverse event reporting, reporting suspected abuse or neglect, disaster relief, and disclosures legally permitted to prevent or lessen a serious and imminent threat.
Oversight and legal obligations. This may include authorized licensing, audit, regulatory or fraud investigations; required disclosures to the U.S. Department of Health and Human Services; and disclosures required by other law.
Courts and law enforcement. We may respond to qualifying court or administrative orders, subpoenas, or law enforcement requests only as the law permits. We follow applicable patient notice, authorization, privilege, and protective requirements.
Other authorized purposes. These may include workers compensation, organ or tissue donation, coroners, medical examiners and funeral directors, and specified military, national security, protective services, or custodial situations, within legal limits.
Research. Information may be used or disclosed for research only with the permissions or protections the law requires. Florida law may require written permission or information abstracted to protect patient identity. We do not treat a general HIPAA research permission as overriding those protections.
Uses requiring your written permission
We obtain written authorization for uses not described in this notice and for most uses or disclosures of psychotherapy notes, marketing requiring authorization, and sale of protected health information requiring authorization. Florida restrictions on solicitation and marketing also apply. You may revoke an authorization in writing, except to the extent we already relied on it or another legal exception applies. Revocation does not erase earlier lawful actions.
Additional confidentiality protections
Florida medical record law restricts disclosure outside the patient, authorized representatives, and treating providers, with specific exceptions. HIV test information has additional protections: a general medical release may be insufficient where specific written consent is required. Mental health and other specially protected records may also require additional permission or legal safeguards. We follow the stricter applicable protection.
If we receive or maintain substance use disorder records protected by 42 CFR Part 2, we follow the additional protections that apply. Those records, and testimony about their contents, may not be used or disclosed in civil, criminal, administrative, or legislative proceedings against you without your written consent or a qualifying court order after required notice and an opportunity to be heard, accompanied by a subpoena or other legal requirement compelling disclosure. A general request for records does not remove these protections.
Fundraising communications
If we contact you for fundraising in a manner permitted by law, you may opt out of future fundraising messages. Your choice will not affect care or payment. Before using Part 2 records for fundraising, we must give a clear opportunity to decline these communications. Any stricter consent requirement also applies.
Questions complaints and notice changes
How to make a complaint
Contact Ana Fakhri, Privacy Officer, at privacy@veinheartandvascular.com or 813-708-8346. You may also write to our practice at 508 S. Habana Avenue, Suite 160, Tampa, FL 33609. Describe your concern and how we can contact you. You are not required to complain to us before contacting the government.
You may file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights at https://www.hhs.gov/hipaa/filing-a-complaint/index.html or by writing to 200 Independence Avenue SW, Washington, DC 20201. For assistance, call 1-800-368-1019. We will not retaliate against you for a complaint.
Changes to this notice
We reserve the right to revise our privacy practices and this notice within the law and to apply the revised notice to information we already maintain as well as information received later. A revised notice will show its effective date and will be available in our offices, upon request, and on the practice website that provides information about these services.
Website choices and clinical permissions
This notice addresses health information held by the practice. Our website privacy policy separately explains website technologies and optional analytics. Accepting a website cookie or analytics banner is not a HIPAA authorization and is not required to receive care. A patient acknowledgment of receiving this notice also does not authorize marketing or other disclosures requiring separate permission.
Request assistance
If you need help understanding this notice or making a request, contact our Privacy Officer. Ask for an accessible copy or communication assistance. For records and sensitive clinical communications, ask our office about the patient portal or another secure channel.